Audit log

Every state-changing event for Chris Larsen: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-15 16:02:02Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 419,935,158

   sig

   36Ty4r8Gxbxw…nMoHnzjtcopyexplorer ↗

   hash

   DubeCyX3Zy7q…konjHwwDcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (17432 B) ▸

   {"actor":"system:backfill","investigation_id":"e5734f78-2101-4c4a-84d8-963676a26bd8","kind":"publish","page_slug":"chris-larsen","published_at":"2026-05-15T16:02:02.185Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Chris Larsen","sections":[{"content":"Christian A. Larsen (born 1960, San Francisco) is a serial fintech entrepreneur. He co-founded online mortgage lender E-Loan in 1996 — the first company to provide consumers free FICO credit scores — and peer-to-peer lending platform Prosper Marketplace in 2006. In 2012, he co-founded Ripple Labs, Inc. alongside Jed McCaleb, serving as CEO until 2016 and thereafter as Executive Chairman. Ripple develops the XRP Ledger and related enterprise payment software. As of 2026, Larsen personally holds approximately 2.5–2.7 billion XRP across multiple wallets, making him one of the largest identified individual holders of XRP on the public ledger.","heading":"Background and Role","severity":"low","sources":[{"credibility":2,"name":"Chris Larsen — Wikipedia","type":"other","url":"https://en.wikipedia.org/wiki/Chris_Larsen"},{"credibility":2,"name":"Who Owns the Most XRP? — Capital.com","type":"news_article","url":"https://capital.com/en-eu/analysis/ripple-who-owns-most-xrp"}]},{"content":"On January 30, 2024, on-chain investigator ZachXBT detected and publicly reported a large, unauthorized outflow of XRP from wallets associated with Chris Larsen. Approximately 213 million XRP — valued at roughly $112.5 million at the time of theft — were siphoned from multiple personal accounts. ZachXBT identified the primary suspected attacker wallet as rJNLz3A1qPKfWCtJLPhmMZAfBkutC2Qojm, with stolen funds distributed across eight wallets and then laundered through at least seven exchanges: MEXC, Gate.io, Binance, Kraken, OKX, HTX, and HitBTC. Larsen publicly confirmed the hack on January 31, 2024 via X (formerly Twitter), clarifying that the breach involved 'a few of my personal XRP accounts' and that Ripple's own wallets were unaffected. He stated that law enforcement had been notified and that affected addresses had been flagged to exchanges. The incident temporarily drove XRP's price down more than 5%. A March 2025 DOJ forfeiture complaint later revised the total stolen to 283 million XRP, worth approximately $150 million at updated valuations.","heading":"January 2024 Personal Wallet Hack ($112–150M XRP Stolen)","severity":"critical","sources":[{"credibility":2,"name":"Ripple's XRP Drops 5% After Executive Is Hacked — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2024/01/31/ripples-xrp-drops-5-amid-report-of-potential-112m-hack"},{"credibility":2,"name":"Ripple Co-Founder Chris Larsen Losing Over $100M of XRP Tied to LastPass Hack — The Block","type":"news_article","url":"https://www.theblock.co/post/345212/ripple-co-founder-chris-larsen-losing-over-100-million-of-xrp-tied-to-lastpass-hack-says-zachxbt"},{"credibility":2,"name":"Chris Larsen confirmation post on X","type":"social_media","url":"https://x.com/chrislarsensf/status/1752702297971532258"},{"credibility":1,"name":"Hackers Steal $112 Million of XRP Ripple Cryptocurrency — TechCrunch","type":"news_article","url":"https://techcrunch.com/2024/01/31/hackers-steal-112-million-of-xrp-ripple-cryptocurrency/"},{"credibility":2,"name":"$112.5 Million in XRP Stolen from Ripple CEO Chris Larsen — Web3 Is Going Great","type":"community_report","url":"https://www.web3isgoinggreat.com/?id=chris-larsen-xrp-theft"}]},{"content":"On February 1–2, 2024, Binance CEO Richard Teng announced that Binance had successfully frozen approximately $4.2 million worth of XRP that had been deposited by the attacker following the hack. Binance stated it would continue monitoring attacker-controlled external wallets and cooperate with Ripple's investigation. The freeze represented a partial recovery — roughly 3.7% of the total stolen at initial valuations — and was coordinated through Ripple's rapid notification to exchanges after the breach was detected.","heading":"Binance Freeze of Stolen Funds","severity":"medium","sources":[{"credibility":2,"name":"Binance Freezes $4.2M in XRP Tokens Stolen From Ripple Executive's Wallet — CoinDesk","type":"news_article","url":"https://www.coindesk.com/markets/2024/02/02/binance-freezes-42m-in-xrp-tokens-stolen-from-ripple-executives-wallet"},{"credibility":2,"name":"Binance Froze $4.2 Million of XRP Stolen in Attack on Ripple Co-Founder — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/binance-froze-4-2-million-of-xrp-stolen-in-attack-on-ripple-co-founder/"}]},{"content":"In March 2025, a forfeiture complaint filed by federal prosecutors in the Northern District of California — and subsequently reported by ZachXBT and Krebs on Security — formally linked the January 2024 XRP theft to the 2022 LastPass data breaches. The complaint states that Larsen (referred to as 'Victim-1') had stored private keys to his XRP wallets in LastPass's 'Secure Notes' feature. LastPass suffered significant security breaches in August 2022 and November 2022, during which encrypted customer vaults were exfiltrated. Investigators concluded that attackers subsequently cracked Larsen's master password offline, accessed his vault, retrieved the stored private keys, and used them to drain his XRP accounts on January 30, 2024. The same attack pattern was attributed to prior thefts from other LastPass users. Security researchers Nick Bax and Taylor Monahan had previously documented this pattern. LastPass itself disputed law enforcement's conclusions, stating it had seen 'no definitive proof...that connects any crypto thefts to our incident.' The forfeiture complaint does not allege any wrongdoing by Larsen — the breach reflects a personal operational security failure (storing unencrypted private keys in a cloud password manager) rather than fraudulent conduct.","heading":"LastPass Breach as Attack Vector","severity":"high","sources":[{"credibility":1,"name":"Feds Link $150M Cyberheist to 2022 LastPass Hacks — Krebs on Security","type":"news_article","url":"https://krebsonsecurity.com/2025/03/feds-link-150m-cyberheist-to-2022-lastpass-hacks/"},{"credibility":2,"name":"Ripple News: XRP Heist Worth $150M Related to LastPass Hack — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2025/03/08/ripple-co-founder-s-usd150m-xrp-heist-related-to-lastpass-hack-zachxbt"},{"credibility":2,"name":"Ripple's Chris Larsen Lost $150M in XRP After LastPass Hack — Protos","type":"news_article","url":"https://protos.com/ripple-ceo-chris-larsen-lost-150m-in-xrp-after-lastpass-hack/"},{"credibility":2,"name":"Ripple Co-Founder Larsen's $150M XRP Theft Linked to LastPass Breach — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/ripple-co-founder-larsen-150m-xrp-theft-password-manager-breach"}]},{"content":"On March 6, 2025, federal prosecutors in the Northern District of California announced the seizure of approximately $23,604,815.09 in cryptocurrency assets traced to the January 2024 theft. Investigators tracked stolen funds to seven exchanges between June 2024 and February 2025: OKX, Kraken (Payward Interactive, Inc.), WhiteBIT, AscendEX Technology SRL, FixedFloat (Ftrader Ltd), SwapSpace LLC, and CoinRabbit (Rabbit Finance LLC). Combined with Binance's earlier freeze of $4.2 million in February 2024, law enforcement has publicly attributed recovery of approximately $27.8 million — roughly 18% of the original $150 million stolen at updated valuations. The forfeiture complaint does not name any suspects for the theft itself as of the date of filing.","heading":"DOJ Forfeiture and Asset Recovery","severity":"high","sources":[{"credibility":1,"name":"US Seizes $23 Million in Crypto Linked to LastPass Breaches — BleepingComputer","type":"regulatory","url":"https://www.bleepingcomputer.com/news/security/us-seizes-23-million-in-crypto-stolen-via-password-manager-breach/"},{"credibility":2,"name":"Feds Seized $23 Million in Crypto Stolen Using Keys from LastPass Breaches — Security Affairs","type":"news_article","url":"https://securityaffairs.com/175156/cyber-crime/feds-seized-23-million-in-crypto-stolen-using-keys-from-lastpass-breaches.html"}]},{"content":"On December 22, 2020, the U.S. Securities and Exchange Commission filed a complaint in the Southern District of New York against Ripple Labs, Inc., CEO Brad Garlinghouse, and co-founder Christian A. Larsen individually. The SEC alleged that Ripple conducted an unregistered securities offering since 2013, raising approximately $1.3 billion through XRP sales. Regarding Larsen personally, the SEC alleged that he effected personal unregistered sales of XRP totaling approximately $600 million. The complaint charged violations of Sections 5(a) and 5(c) of the Securities Act of 1933 and sought injunctive relief, disgorgement, and civil penalties. No fraud was alleged — the claims concerned registration requirements only. In July 2023, U.S. District Judge Analisa Torres issued a summary judgment finding that Ripple's institutional sales of XRP constituted unregistered securities offerings, but that programmatic secondary-market sales did not. In October 2023, the SEC dropped all personal claims against Larsen and Garlinghouse. Following further appeals proceedings, Ripple and the SEC reached a final settlement in 2025: Ripple agreed to pay a $125 million civil penalty (returning $75 million of a prior $150 million court-ordered amount), and all executive-level charges were fully dismissed. Larsen was cleared of all personal liability.","heading":"SEC Enforcement: Unregistered Securities Offering","severity":"high","sources":[{"credibility":1,"name":"SEC Charges Ripple and Two Executives with Conducting $1.3 Billion Unregistered Securities Offering — SEC.gov","type":"regulatory","url":"https://www.sec.gov/newsroom/press-releases/2020-338"},{"credibility":1,"name":"SEC Litigation Release — Ripple Labs, Christian Larsen — SEC.gov","type":"regulatory","url":"https://www.sec.gov/enforcement-litigation/litigation-releases/lr-26306"},{"credibility":1,"name":"Ripple Labs Co-Founder Cleared of All Allegations — Paul Weiss","type":"official","url":"https://www.paulweiss.com/insights/client-news/ripple-labs-co-founder-cleared-of-all-allegations-in-landmark-sec-crypto-enforcement-action"},{"credibility":2,"name":"Ripple to Drop Cross-Appeal Against SEC — CoinDesk","type":"news_article","url":"https://www.coindesk.com/policy/2025/06/27/ripple-to-drop-cross-appeal-against-sec-ending-years-long-legal-battle-with-sec"},{"credibility":1,"name":"Crypto's Long Battle With SEC Comes to a Close With Ripple Victory — CNBC","type":"news_article","url":"https://www.cnbc.com/2025/03/22/cryptos-long-battle-with-sec-comes-to-a-close-with-ripple-victory.html"},{"credibility":1,"name":"SEC Settlement Statement on Ripple — SEC.gov","type":"regulatory","url":"https://www.sec.gov/newsroom/speeches-statements/crenshaw-statement-ripple-050825"}]},{"content":"Larsen is one of the largest publicly identified individual holders of XRP, holding an estimated 2.5–2.7 billion XRP as of early 2026 — approximately 4.6% of XRP's circulating supply. His holdings give him significant market influence; at XRP's January 2024 all-time high of approximately $3.84, his stack carried a paper value exceeding $10 billion. The attacker wallet identified by ZachXBT in the January 2024 hack (rJNLz3A1qPKfWCtJLPhmMZAfBkutC2Qojm) distributed stolen funds across eight intermediary wallets before routing proceeds to major exchanges. ZachXBT's analysis tracked the fund flows in near-real time, enabling Larsen and Ripple to alert exchanges and coordinate the Binance freeze within approximately 24 hours of the initial theft.","heading":"On-Chain Profile and Exchange Activity","severity":"medium","sources":[{"credibility":2,"name":"ZachXBT Tracks Over $100M in XRP Sent to Exchanges — Crypto.news","type":"on_chain","url":"https://crypto.news/zachxbt-tracks-over-100m-in-xrp-sent-to-exchanges-by-chris-larsen/"},{"credibility":3,"name":"Who Owns the Most XRP? Top 10 XRP Rich List — BingX","type":"research","url":"https://bingx.com/en/learn/article/top-xrp-holders-xrp-rich-list-who-owns-the-most-xrp"}]}],"sources_used":[],"summary":"Chris Larsen is the co-founder and Executive Chairman of Ripple Labs, the company behind the XRP digital asset. On January 30, 2024, his personal XRP wallets were compromised in a hack attributed to private key exposure stemming from the 2022 LastPass data breach, resulting in approximately 283 million XRP (valued at $112–150 million at the time) being stolen. Separately, Larsen was named as an individual defendant in the SEC's December 2020 lawsuit alleging $1.3 billion in unregistered securities offerings via XRP sales; all personal charges against him were ultimately dropped as part of the case's 2025 resolution.","timeline":[{"date":"2012-09","event":"Chris Larsen co-founds Ripple Labs, Inc. alongside Jed McCaleb; becomes CEO.","source":"Wikipedia","source_url":"https://en.wikipedia.org/wiki/Chris_Larsen"},{"date":"2013-01","event":"Ripple begins selling XRP to institutional investors; the SEC would later allege this constituted an unregistered securities offering.","source":"SEC Press Release 2020-338","source_url":"https://www.sec.gov/newsroom/press-releases/2020-338"},{"date":"2016-01","event":"Larsen steps down as CEO of Ripple; becomes Executive Chairman.","source":"Wikipedia","source_url":"https://en.wikipedia.org/wiki/Chris_Larsen"},{"date":"2020-12","event":"SEC files complaint against Ripple Labs, Brad Garlinghouse, and Christian A. Larsen, alleging $1.3 billion in unregistered XRP securities offerings. Larsen personally alleged to have sold approximately $600 million in unregistered XRP.","source":"SEC.gov","source_url":"https://www.sec.gov/newsroom/press-releases/2020-338"},{"date":"2022-08","event":"LastPass suffers first major security breach; source code and technical information exfiltrated.","source":"Krebs on Security","source_url":"https://krebsonsecurity.com/2025/03/feds-link-150m-cyberheist-to-2022-lastpass-hacks/"},{"date":"2022-11","event":"LastPass suffers second breach; encrypted customer password vaults stolen. Larsen's vault — allegedly containing XRP private keys in Secure Notes — is among those compromised.","source":"Krebs on Security","source_url":"https://krebsonsecurity.com/2025/03/feds-link-150m-cyberheist-to-2022-lastpass-hacks/"},{"date":"2023-07","event":"U.S. District Judge Analisa Torres issues summary judgment in SEC v. Ripple: institutional XRP sales violated securities law; programmatic secondary-market sales did not.","source":"CNBC","source_url":"https://www.cnbc.com/2025/03/22/cryptos-long-battle-with-sec-comes-to-a-close-with-ripple-victory.html"},{"date":"2023-10","event":"SEC drops all personal charges against Larsen and Garlinghouse; case against Ripple Labs continues.","source":"BusinessWire / Paul Weiss","source_url":"https://www.paulweiss.com/insights/client-news/ripple-labs-co-founder-cleared-of-all-allegations-in-landmark-sec-crypto-enforcement-action"},{"date":"2024-01-30","event":"Larsen's personal XRP wallets hacked; approximately 213 million XRP ($112.5M) drained. ZachXBT detects and reports the unauthorized outflows in real time. Stolen funds routed through MEXC, Gate.io, Binance, Kraken, OKX, HTX, and HitBTC.","source":"CoinDesk / TechCrunch","source_url":"https://techcrunch.com/2024/01/31/hackers-steal-112-million-of-xrp-ripple-cryptocurrency/"},{"date":"2024-01-31","event":"Larsen publicly confirms hack via X, states breach was limited to personal accounts, law enforcement notified, exchanges alerted to freeze affected addresses.","source":"X (@chrislarsensf)","source_url":"https://x.com/chrislarsensf/status/1752702297971532258"},{"date":"2024-02-01","event":"Binance CEO Richard Teng announces Binance has frozen $4.2 million worth of stolen XRP deposits made by the attacker.","source":"CoinDesk","source_url":"https://www.coindesk.com/markets/2024/02/02/binance-freezes-42m-in-xrp-tokens-stolen-from-ripple-executives-wallet"},{"date":"2025-03-06","event":"Federal prosecutors in Northern District of California announce seizure of $23,604,815 in cryptocurrency traced to the January 2024 theft, from exchanges OKX, Kraken, WhiteBIT, AscendEX, FixedFloat, SwapSpace, and CoinRabbit. Forfeiture complaint formally links the theft to the 2022 LastPass breaches.","source":"BleepingComputer","source_url":"https://www.bleepingcomputer.com/news/security/us-seizes-23-million-in-crypto-stolen-via-password-manager-breach/"},{"date":"2025-03","event":"ZachXBT and Krebs on Security report the forfeiture complaint's findings; forfeiture document identifies Larsen as Victim-1 and confirms the LastPass breach as the attack vector. Total stolen revised upward to $150M (283M XRP at updated valuations).","source":"Krebs on Security","source_url":"https://krebsonsecurity.com/2025/03/feds-link-150m-cyberheist-to-2022-lastpass-hacks/"},{"date":"2025-03","event":"SEC and Ripple reach final settlement. Ripple pays $125 million civil penalty. All appeals dropped. All charges against Larsen personally are fully resolved with no admission of wrongdoing.","source":"CNBC / CoinDesk","source_url":"https://www.cnbc.com/2025/03/22/cryptos-long-battle-with-sec-comes-to-a-close-with-ripple-victory.html"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ca17f934-c67a-401a-9b09-8cd155dfb148copy